Server Intermediary for XSRF Token Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing Cross Site Request Forgery (XSRF) attacks require redesigning legacy web applications to include security tokens in URL arguments, which is impractical and inefficient.
Innovation Solution
Generating a session token for each session, embedding it in a session cookie, and rewriting the URL to include the security token, allowing the server to verify it without needing application reprogramming, thus incorporating increased security without altering existing applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security tokens are included in URL arguments to prevent XSRF attacks, then security is improved, but application redesign is required which increases complexity and reduces ease of manufacture
Solution Approach 1:
The patent introduces a server-side intermediary component that automatically generates and manages security tokens. Instead of requiring application code to manually handle tokens, the server acts as an intermediary that injects tokens into URLs and verifies them automatically, thus improving security without requiring application redesign
Solution Approach 2:
The system implements self-service by having the server automatically generate, embed, and verify security tokens without human intervention or application reprogramming. The server autonomously manages the token lifecycle, including generation upon user authentication and verification for subsequent requests, eliminating the need for manual security token management in application code
2Reliability
If legacy web applications are reprogrammed to include security tokens in form data, then security is improved, but productivity and ease of operation deteriorate due to the need for reprogramming
Solution Approach 1:
The server-side intermediary automatically handles security token generation and verification, eliminating the need for reprogramming legacy applications. The intermediary intercepts requests, generates tokens, and verifies them server-side, allowing legacy applications to maintain their original form data handling while still achieving security through the intermediary layer
Solution Approach 2:
Instead of modifying applications to include tokens in form data, the patent inverts the approach by having the server embed tokens in URLs and verify them there. This inversion allows security to be implemented without touching legacy application code, thus maintaining productivity while improving security
3Reliability
If security tokens are embedded in form data, then security is improved, but device complexity increases as all pages must handle tokens
Solution Approach 1:
The server acts as an intermediary that centralizes token handling logic. Instead of distributing complex token handling across all application pages, the server intermediary统一管理 token generation, embedding in URLs, and verification, thus reducing overall system complexity while maintaining security
Solution Approach 2:
The patent extracts the complex token handling logic from the application layer and places it in the server layer. By taking out the token management responsibility from individual application pages and consolidating it in the server intermediary, the complexity is isolated and simplified, making the system easier to maintain while preserving security
Data Source
AI summary
An improved method for preventing XSRF attack on a web site, which has a URL and is accessible from a port on a server. This invention: determines whether a requestor is legitimate; generates a session token for each session on the web site requested by the legitimate requestor; embeds the session token in a session cookie; additionally generates a security token; embeds the security token in the original request URL; and redirects the web site request to the newly formed URL. The subsequent request of the URL containing the security token allows the server to verify the token and serve the web site to the legitimate requestor. In other words the server's web site for that user for that session is: port/security token/URL/ form data.